fix: show hero image in thumbnail grid on hero gallery layout

backend/src/middleware/auth-enhanced-v2.js

@@ -0,0 +1,166 @@
+const jwt = require('jsonwebtoken');
+const { db } = require('../database/db');
+const { isTokenRevoked } = require('../utils/tokenRevocation');
+const logger = require('../utils/logger');
+
+/**
+ * Enhanced admin authentication middleware with revocation checking
+ */
+async function adminAuth(req, res, next) {
+  try {
+    const token = req.headers.authorization?.split(' ')[1];
+    if (!token) {
+      return res.status(401).json({ error: 'No token provided' });
+    }
+    
+    let decoded;
+    try {
+      decoded = jwt.verify(token, process.env.JWT_SECRET, {
+        issuer: 'picpeak-auth',
+        complete: true
+      });
+      decoded = decoded.payload;
+    } catch (err) {
+      if (err.name === 'TokenExpiredError') {
+        return res.status(401).json({ error: 'Token expired', code: 'TOKEN_EXPIRED' });
+      }
+      return res.status(401).json({ error: 'Invalid token' });
+    }
+    
+    // Check if token is revoked
+    if (await isTokenRevoked(decoded)) {
+      logger.warn('Revoked token used', {
+        userId: decoded.id,
+        tokenType: decoded.type
+      });
+      return res.status(401).json({ error: 'Token has been revoked', code: 'TOKEN_REVOKED' });
+    }
+    
+    // Verify token type
+    if (decoded.type !== 'admin') {
+      logger.warn('Non-admin token used for admin endpoint', { 
+        userId: decoded.id,
+        tokenType: decoded.type 
+      });
+      return res.status(403).json({ error: 'Insufficient permissions' });
+    }
+    
+    // IP validation (optional - can be strict or just log)
+    const currentIp = req.ip || req.connection.remoteAddress;
+    if (decoded.ip && decoded.ip !== currentIp) {
+      logger.warn('Token used from different IP', {
+        userId: decoded.id,
+        tokenIp: decoded.ip,
+        currentIp: currentIp
+      });
+    }
+    
+    // Check if admin still exists and is active
+    const admin = await db('admin_users')
+      .where({ id: decoded.id, is_active: true })
+      .first();
+    
+    if (!admin) {
+      return res.status(401).json({ error: 'Invalid token' });
+    }
+    
+    // Check if password was changed after token was issued
+    if (admin.password_changed_at) {
+      const passwordChangedTime = new Date(admin.password_changed_at).getTime() / 1000;
+      if (decoded.iat < passwordChangedTime) {
+        logger.warn('Token used after password change', { userId: decoded.id });
+        return res.status(401).json({ 
+          error: 'Token invalid due to password change',
+          code: 'PASSWORD_CHANGED'
+        });
+      }
+    }
+    
+    // Add user info to request
+    req.admin = {
+      id: admin.id,
+      username: admin.username,
+      email: admin.email
+    };
+    req.token = token; // Store token for potential revocation
+    
+    next();
+  } catch (error) {
+    logger.error('Auth middleware error:', error);
+    res.status(401).json({ error: 'Authentication failed' });
+  }
+}
+
+/**
+ * Enhanced gallery authentication middleware with revocation checking
+ */
+async function galleryAuth(req, res, next) {
+  try {
+    const token = req.headers.authorization?.split(' ')[1];
+    if (!token) {
+      return res.status(401).json({ error: 'No token provided' });
+    }
+    
+    let decoded;
+    try {
+      decoded = jwt.verify(token, process.env.JWT_SECRET, {
+        issuer: 'picpeak-auth',
+        complete: true
+      });
+      decoded = decoded.payload;
+    } catch (err) {
+      if (err.name === 'TokenExpiredError') {
+        return res.status(401).json({ error: 'Session expired', code: 'TOKEN_EXPIRED' });
+      }
+      return res.status(401).json({ error: 'Invalid session' });
+    }
+    
+    // Check if token is revoked
+    if (await isTokenRevoked(decoded)) {
+      return res.status(401).json({ error: 'Session has been invalidated', code: 'TOKEN_REVOKED' });
+    }
+    
+    // Verify token type
+    if (decoded.type !== 'gallery') {
+      return res.status(403).json({ error: 'Invalid access token' });
+    }
+    
+    // Check if event still exists and is active
+    const event = await db('events')
+      .where({ 
+        id: decoded.eventId, 
+        is_active: true, 
+        is_archived: false 
+      })
+      .first();
+    
+    if (!event) {
+      return res.status(404).json({ error: 'Gallery not found or expired' });
+    }
+    
+    // Check if gallery has expired
+    if (new Date(event.expires_at) < new Date()) {
+      return res.status(410).json({ 
+        error: 'Gallery has expired',
+        code: 'GALLERY_EXPIRED'
+      });
+    }
+    
+    // Add event info to request
+    req.event = event;
+    req.galleryToken = decoded;
+    req.token = token;
+    
+    next();
+  } catch (error) {
+    logger.error('Gallery auth middleware error:', error);
+    res.status(401).json({ error: 'Authentication failed' });
+  }
+}
+
+// Export other middleware functions from original file...
+module.exports = { 
+  adminAuth, 
+  galleryAuth,
+  // ... other exports
+};

backend/src/routes/adminArchives.js

@@ -2,7 +2,7 @@ const express = require('express');
 const path = require('path');
 const fs = require('fs').promises;
 const { db } = require('../database/db');
-const { adminAuth } = require('../middleware/auth');
+const { adminAuth } = require('../middleware/auth-enhanced-v2');
 const archiver = require('archiver');
 const AdmZip = require('adm-zip');
 const router = express.Router();

backend/src/routes/adminAuth.js

@@ -2,7 +2,7 @@ const express = require('express');
 const bcrypt = require('bcrypt');
 const { body, validationResult } = require('express-validator');
 const { db, logActivity } = require('../database/db');
-const { adminAuth } = require('../middleware/auth');
+const { adminAuth } = require('../middleware/auth-enhanced-v2');
 const { endSession } = require('../middleware/sessionTimeout');
 const { validatePasswordStrength } = require('../utils/passwordGenerator');
 const router = express.Router();

backend/src/routes/adminCMS.js

@@ -1,7 +1,7 @@
 const express = require('express');
 const { body, validationResult } = require('express-validator');
 const { db, logActivity } = require('../database/db');
-const { adminAuth } = require('../middleware/auth');
+const { adminAuth } = require('../middleware/auth-enhanced-v2');
 const router = express.Router();
 
 // Get all CMS pages

backend/src/routes/adminCategories.js

@@ -1,7 +1,7 @@
 const express = require('express');
 const { body, validationResult } = require('express-validator');
 const { db, logActivity } = require('../database/db');
-const { adminAuth } = require('../middleware/auth');
+const { adminAuth } = require('../middleware/auth-enhanced-v2');
 const router = express.Router();
 
 // Get all global categories

backend/src/routes/adminDashboard.js

@@ -1,6 +1,6 @@
 const express = require('express');
 const { db } = require('../database/db');
-const { adminAuth } = require('../middleware/auth');
+const { adminAuth } = require('../middleware/auth-enhanced-v2');
 const { sanitizeDays, addDateRangeCondition } = require('../utils/sqlSecurity');
 const router = express.Router();
 

backend/src/routes/adminEmail.js

@@ -2,7 +2,7 @@ const express = require('express');
 const nodemailer = require('nodemailer');
 const { body, validationResult } = require('express-validator');
 const { db, logActivity } = require('../database/db');
-const { adminAuth } = require('../middleware/auth');
+const { adminAuth } = require('../middleware/auth-enhanced-v2');
 const router = express.Router();
 
 // Get email configuration

backend/src/routes/adminEvents-enhanced.js

@@ -0,0 +1,121 @@
+// This is a partial file showing the enhanced event creation with password validation
+// Only the relevant parts are shown - merge with existing adminEvents.js
+
+const { validatePasswordInContext, getBcryptRounds } = require('../utils/passwordValidation');
+
+// Enhanced event creation with password validation
+router.post('/', adminAuth, [
+  body('event_type').isIn(['wedding', 'birthday', 'corporate', 'other']),
+  body('event_name').notEmpty().trim(),
+  body('event_date').isDate(),
+  body('host_email').isEmail().normalizeEmail(),
+  body('admin_email').isEmail().normalizeEmail(),
+  body('password').notEmpty(), // Remove the weak isLength validation
+  body('expiration_days').isInt({ min: 1, max: 365 }).optional(),
+  body('welcome_message').optional().trim(),
+  body('color_theme').optional().trim(),
+  body('allow_user_uploads').optional().isBoolean().toBoolean(),
+  body('upload_category_id').optional({ nullable: true, checkFalsy: true }).isInt(),
+  body('host_name').notEmpty().trim()
+], async (req, res) => {
+  try {
+    console.log('Create event request body:', req.body);
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      console.error('Validation errors:', errors.array());
+      return res.status(400).json({ errors: errors.array() });
+    }
+    
+    const {
+      event_type,
+      event_name,
+      event_date,
+      host_name,
+      host_email,
+      admin_email,
+      password,
+      welcome_message = '',
+      color_theme = null,
+      expiration_days = 30,
+      allow_user_uploads = false,
+      upload_category_id = null
+    } = req.body;
+    
+    // Validate password strength for gallery
+    const passwordValidation = validatePasswordInContext(password, 'gallery', {
+      eventName: event_name
+    });
+    
+    if (!passwordValidation.valid) {
+      return res.status(400).json({ 
+        error: 'Password does not meet security requirements',
+        details: passwordValidation.errors,
+        score: passwordValidation.score,
+        feedback: passwordValidation.feedback
+      });
+    }
+    
+    // Generate unique slug
+    const baseSlug = `${event_type}-${event_name.toLowerCase().replace(/[^a-z0-9]/g, '-')}-${event_date}`;
+    let slug = baseSlug;
+    let counter = 1;
+    
+    while (await db('events').where({ slug }).first()) {
+      slug = `${baseSlug}-${counter}`;
+      counter++;
+    }
+    
+    // Generate share link
+    const shareToken = crypto.randomBytes(16).toString('hex');
+    const shareLink = `${process.env.FRONTEND_URL}/gallery/${slug}/${shareToken}`;
+    
+    // Hash password with configurable rounds
+    const password_hash = await bcrypt.hash(password, getBcryptRounds());
+    
+    // Calculate expiration date (days after event date)
+    const expires_at = new Date(event_date);
+    expires_at.setDate(expires_at.getDate() + parseInt(expiration_days, 10));
+    
+    // Create folder structure
+    const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+    const eventPath = path.join(storagePath, 'events/active', slug);
+    await fs.mkdir(path.join(eventPath, 'collages'), { recursive: true });
+    await fs.mkdir(path.join(eventPath, 'individual'), { recursive: true });
+    
+    // Insert into database
+    const [eventId] = await db('events').insert({
+      slug,
+      event_type,
+      event_name,
+      event_date,
+      host_name,
+      host_email,
+      admin_email,
+      password_hash,
+      welcome_message,
+      color_theme,
+      share_link: shareLink,
+      expires_at: expires_at.toISOString(),
+      created_at: new Date().toISOString(),
+      allow_user_uploads,
+      upload_category_id
+    });
+    
+    // Log activity
+    await logActivity('event_created', 
+      { 
+        event_type, 
+        expires_at,
+        password_strength: passwordValidation.score 
+      }, 
+      eventId, 
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+    
+    // Rest of the implementation remains the same...
+    // Queue creation email, etc.
+  } catch (error) {
+    console.error('Error creating event:', error);
+    res.status(500).json({ error: 'Failed to create event' });
+  }
+});

backend/src/routes/adminEvents.js

@@ -1,7 +1,7 @@
 const express = require('express');
 const { body, query, validationResult } = require('express-validator');
 const { db, logActivity } = require('../database/db');
-const { adminAuth } = require('../middleware/auth');
+const { adminAuth } = require('../middleware/auth-enhanced-v2');
 const router = express.Router();
 const bcrypt = require('bcrypt');
 const crypto = require('crypto');
@@ -10,6 +10,7 @@ const path = require('path');
 const { archiveEvent } = require('../services/archiveService');
 const { escapeLikePattern } = require('../utils/sqlSecurity');
 const { formatDate } = require('../utils/dateFormatter');
+const { validatePasswordInContext, getBcryptRounds } = require('../utils/passwordValidation');
 
 // Create new event
 router.post('/', adminAuth, [
@@ -49,6 +50,20 @@ router.post('/', adminAuth, [
       upload_category_id = null
     } = req.body;
     
+    // Validate password strength
+    const passwordValidation = validatePasswordInContext(password, 'gallery', {
+      eventName: event_name
+    });
+    
+    if (!passwordValidation.valid) {
+      return res.status(400).json({ 
+        error: 'Password does not meet security requirements',
+        details: passwordValidation.errors,
+        score: passwordValidation.score,
+        feedback: passwordValidation.feedback
+      });
+    }
+    
     // Generate unique slug
     const baseSlug = `${event_type}-${event_name.toLowerCase().replace(/[^a-z0-9]/g, '-')}-${event_date}`;
     let slug = baseSlug;
@@ -63,8 +78,8 @@ router.post('/', adminAuth, [
     const shareToken = crypto.randomBytes(16).toString('hex');
     const shareLink = `${process.env.FRONTEND_URL}/gallery/${slug}/${shareToken}`;
     
-    // Hash password
-    const password_hash = await bcrypt.hash(password, 10);
+    // Hash password with configurable rounds
+    const password_hash = await bcrypt.hash(password, getBcryptRounds());
     
     // Calculate expiration date (days after event date)
     const expires_at = new Date(event_date);

backend/src/routes/adminNotifications.js

@@ -1,6 +1,6 @@
 const express = require('express');
 const { db, logActivity } = require('../database/db');
-const { adminAuth } = require('../middleware/auth');
+const { adminAuth } = require('../middleware/auth-enhanced-v2');
 const router = express.Router();
 
 // Get notifications (unread activity logs)

backend/src/routes/adminSystem.js

@@ -1,6 +1,6 @@
 const express = require('express');
 const { db } = require('../database/db');
-const { adminAuth } = require('../middleware/auth');
+const { adminAuth } = require('../middleware/auth-enhanced-v2');
 const fs = require('fs').promises;
 const path = require('path');
 const os = require('os');

backend/src/routes/auth-enhanced-v2.js

@@ -0,0 +1,374 @@
+const express = require('express');
+const bcrypt = require('bcrypt');
+const jwt = require('jsonwebtoken');
+const { body, validationResult } = require('express-validator');
+const { db } = require('../database/db');
+const { verifyRecaptcha } = require('../services/recaptcha');
+const { 
+  trackFailedAttempt,
+  trackSuccessfulLogin,
+  checkAccountLockout,
+  checkSuspiciousActivity,
+  getGenericAuthError
+} = require('../utils/authSecurity');
+const { 
+  validatePasswordInContext,
+  getBcryptRounds,
+  logPasswordValidationFailure
+} = require('../utils/passwordValidation');
+const { endSession } = require('../middleware/sessionTimeout');
+const logger = require('../utils/logger');
+const router = express.Router();
+
+// Admin login with enhanced security
+router.post('/admin/login', [
+  body('username').notEmpty().trim(),
+  body('password').notEmpty()
+], async (req, res) => {
+  try {
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      return res.status(400).json({ errors: errors.array() });
+    }
+    
+    const { username, password, recaptchaToken } = req.body;
+    const ipAddress = req.ip || req.connection.remoteAddress;
+    const userAgent = req.headers['user-agent'] || '';
+    
+    // Check account lockout first
+    const lockoutStatus = await checkAccountLockout(username);
+    if (lockoutStatus.isLocked) {
+      logger.warn('Login attempt on locked account', { username, ipAddress });
+      return res.status(423).json({ 
+        error: 'Account temporarily locked due to too many failed attempts',
+        retryAfter: lockoutStatus.remainingTime
+      });
+    }
+    
+    // Verify reCAPTCHA
+    const recaptchaValid = await verifyRecaptcha(recaptchaToken);
+    if (!recaptchaValid) {
+      await trackFailedAttempt(username, ipAddress, userAgent);
+      return res.status(400).json({ error: 'reCAPTCHA verification failed' });
+    }
+    
+    // Check for suspicious activity
+    const isSuspicious = await checkSuspiciousActivity(username, ipAddress);
+    if (isSuspicious) {
+      // Still allow login but log it
+      logger.warn('Suspicious login pattern detected', { username, ipAddress });
+    }
+    
+    const admin = await db('admin_users')
+      .where({ username })
+      .orWhere({ email: username })
+      .first();
+    
+    // Use generic error to prevent user enumeration
+    if (!admin || !await bcrypt.compare(password, admin.password_hash)) {
+      await trackFailedAttempt(username, ipAddress, userAgent);
+      return res.status(401).json({ error: getGenericAuthError() });
+    }
+    
+    if (!admin.is_active) {
+      await trackFailedAttempt(username, ipAddress, userAgent);
+      return res.status(401).json({ error: getGenericAuthError() });
+    }
+    
+    // Successful login
+    await trackSuccessfulLogin(username, ipAddress, userAgent);
+    
+    // Update last login and login metadata
+    await db('admin_users').where('id', admin.id).update({ 
+      last_login: new Date(),
+      last_login_ip: ipAddress
+    });
+    
+    // Generate token with additional claims
+    const token = jwt.sign({ 
+      id: admin.id,
+      username: admin.username,
+      type: 'admin',
+      ip: ipAddress,
+      loginTime: Date.now()
+    }, process.env.JWT_SECRET, { 
+      expiresIn: '24h',
+      issuer: 'picpeak-auth'
+    });
+    
+    res.json({
+      token,
+      user: {
+        id: admin.id,
+        username: admin.username,
+        email: admin.email,
+        mustChangePassword: admin.must_change_password || false
+      }
+    });
+  } catch (error) {
+    logger.error('Login error:', error);
+    res.status(500).json({ error: 'Login failed' });
+  }
+});
+
+// Admin password change with validation
+router.post('/admin/change-password', [
+  body('currentPassword').notEmpty(),
+  body('newPassword').notEmpty(),
+  body('confirmPassword').notEmpty()
+    .custom((value, { req }) => value === req.body.newPassword)
+    .withMessage('Passwords do not match')
+], async (req, res) => {
+  try {
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      return res.status(400).json({ errors: errors.array() });
+    }
+    
+    const { currentPassword, newPassword } = req.body;
+    const adminId = req.admin.id; // From auth middleware
+    
+    // Get admin user
+    const admin = await db('admin_users').where({ id: adminId }).first();
+    if (!admin) {
+      return res.status(404).json({ error: 'User not found' });
+    }
+    
+    // Verify current password
+    const validPassword = await bcrypt.compare(currentPassword, admin.password_hash);
+    if (!validPassword) {
+      return res.status(401).json({ error: 'Current password is incorrect' });
+    }
+    
+    // Validate new password
+    const passwordValidation = validatePasswordInContext(newPassword, 'admin', {
+      username: admin.username,
+      email: admin.email
+    });
+    
+    if (!passwordValidation.valid) {
+      logPasswordValidationFailure('admin_password_change', passwordValidation.errors, {
+        userId: adminId,
+        username: admin.username
+      });
+      
+      return res.status(400).json({ 
+        error: 'Password does not meet security requirements',
+        details: passwordValidation.errors,
+        score: passwordValidation.score,
+        feedback: passwordValidation.feedback
+      });
+    }
+    
+    // Hash new password with configurable rounds
+    const hashedPassword = await bcrypt.hash(newPassword, getBcryptRounds());
+    
+    // Update password and track change time
+    await db('admin_users').where('id', adminId).update({
+      password_hash: hashedPassword,
+      password_changed_at: new Date(),
+      must_change_password: false
+    });
+    
+    // Log password change
+    logger.info('Admin password changed', {
+      userId: adminId,
+      username: admin.username,
+      ip: req.ip
+    });
+    
+    res.json({ 
+      message: 'Password changed successfully',
+      score: passwordValidation.score
+    });
+  } catch (error) {
+    logger.error('Password change error:', error);
+    res.status(500).json({ error: 'Failed to change password' });
+  }
+});
+
+// Logout endpoint
+router.post('/logout', async (req, res) => {
+  try {
+    const token = req.headers.authorization?.split(' ')[1];
+    
+    if (token) {
+      // End the session
+      endSession(token);
+      
+      // Log the logout
+      try {
+        const decoded = jwt.verify(token, process.env.JWT_SECRET);
+        logger.info('User logged out', { 
+          userId: decoded.id,
+          username: decoded.username,
+          type: decoded.type
+        });
+      } catch (err) {
+        // Token might be invalid, but still process logout
+      }
+    }
+    
+    res.json({ message: 'Logged out successfully' });
+  } catch (error) {
+    logger.error('Logout error:', error);
+    res.status(500).json({ error: 'Logout failed' });
+  }
+});
+
+// Gallery password verification with enhanced security
+router.post('/gallery/verify', [
+  body('slug').notEmpty().trim(),
+  body('password').notEmpty()
+], async (req, res) => {
+  try {
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      return res.status(400).json({ errors: errors.array() });
+    }
+    
+    const { slug, password, recaptchaToken } = req.body;
+    const ipAddress = req.ip || req.connection.remoteAddress;
+    const userAgent = req.headers['user-agent'] || '';
+    
+    // Check gallery-specific lockout
+    const lockoutStatus = await checkAccountLockout(`gallery:${slug}`);
+    if (lockoutStatus.isLocked) {
+      logger.warn('Gallery access attempt on locked gallery', { slug, ipAddress });
+      return res.status(423).json({ 
+        error: 'Too many failed attempts. Please try again later.',
+        retryAfter: lockoutStatus.remainingTime
+      });
+    }
+    
+    // Verify reCAPTCHA
+    const recaptchaValid = await verifyRecaptcha(recaptchaToken);
+    if (!recaptchaValid) {
+      await trackFailedAttempt(`gallery:${slug}`, ipAddress, userAgent);
+      return res.status(400).json({ error: 'reCAPTCHA verification failed' });
+    }
+    
+    const event = await db('events').where({ slug, is_active: true, is_archived: false }).first();
+    if (!event) {
+      // Don't reveal if gallery exists
+      await trackFailedAttempt(`gallery:${slug}`, ipAddress, userAgent);
+      return res.status(401).json({ error: 'Invalid gallery or password' });
+    }
+    
+    const validPassword = await bcrypt.compare(password, event.password_hash);
+    if (!validPassword) {
+      await trackFailedAttempt(`gallery:${slug}`, ipAddress, userAgent);
+      await db('access_logs').insert({
+        event_id: event.id,
+        ip_address: ipAddress,
+        user_agent: userAgent,
+        action: 'login_fail'
+      });
+      return res.status(401).json({ error: 'Invalid gallery or password' });
+    }
+    
+    // Successful access
+    await trackSuccessfulLogin(`gallery:${slug}`, ipAddress, userAgent);
+    
+    // Log successful access
+    await db('access_logs').insert({
+      event_id: event.id,
+      ip_address: ipAddress,
+      user_agent: userAgent,
+      action: 'login_success'
+    });
+    
+    // Generate session token with additional security info
+    const token = jwt.sign({ 
+      eventId: event.id, 
+      eventSlug: event.slug,
+      type: 'gallery',
+      ip: ipAddress,
+      loginTime: Date.now()
+    }, process.env.JWT_SECRET, { 
+      expiresIn: '24h',
+      issuer: 'picpeak-auth'
+    });
+    
+    res.json({
+      token,
+      event: {
+        id: event.id,
+        event_name: event.event_name,
+        event_type: event.event_type,
+        event_date: event.event_date,
+        welcome_message: event.welcome_message,
+        color_theme: event.color_theme,
+        expires_at: event.expires_at,
+        allow_user_uploads: event.allow_user_uploads,
+        upload_category_id: event.upload_category_id
+      }
+    });
+  } catch (error) {
+    logger.error('Gallery verification error:', error);
+    res.status(500).json({ error: 'Verification failed' });
+  }
+});
+
+// Get current session info
+router.get('/session', async (req, res) => {
+  try {
+    const token = req.headers.authorization?.split(' ')[1];
+    
+    if (!token) {
+      return res.status(401).json({ error: 'No token provided' });
+    }
+    
+    try {
+      const decoded = jwt.verify(token, process.env.JWT_SECRET);
+      
+      // Calculate remaining time
+      const now = Date.now() / 1000;
+      const remainingTime = Math.max(0, decoded.exp - now);
+      
+      res.json({
+        valid: true,
+        type: decoded.type,
+        expiresIn: Math.floor(remainingTime),
+        user: decoded.username || decoded.eventSlug
+      });
+    } catch (err) {
+      res.json({
+        valid: false,
+        error: 'Invalid or expired token'
+      });
+    }
+  } catch (error) {
+    res.status(500).json({ error: 'Session check failed' });
+  }
+});
+
+// Password strength check endpoint (for real-time validation)
+router.post('/password-strength', [
+  body('password').notEmpty(),
+  body('context').isIn(['admin', 'gallery']).optional()
+], async (req, res) => {
+  try {
+    const { password, context = 'gallery' } = req.body;
+    
+    // Get user data if available (for context-aware validation)
+    const userData = {};
+    if (context === 'admin' && req.admin) {
+      userData.username = req.admin.username;
+      userData.email = req.admin.email;
+    }
+    
+    const validation = validatePasswordInContext(password, context, userData);
+    
+    res.json({
+      valid: validation.valid,
+      score: validation.score,
+      errors: validation.errors,
+      feedback: validation.feedback
+    });
+  } catch (error) {
+    res.status(500).json({ error: 'Failed to check password strength' });
+  }
+});
+
+module.exports = router;

backend/src/routes/events.js

@@ -3,7 +3,7 @@ const { body, validationResult } = require('express-validator');
 const bcrypt = require('bcrypt');
 const crypto = require('crypto');
 const { db } = require('../database/db');
-const { adminAuth } = require('../middleware/auth');
+const { adminAuth } = require('../middleware/auth-enhanced-v2');
 const fs = require('fs').promises;
 const path = require('path');
 const router = express.Router();

backend/src/utils/passwordValidation.js

@@ -0,0 +1,243 @@
+/**
+ * Password Validation and Security Utilities
+ * Implements strong password requirements and security checks
+ */
+
+const zxcvbn = require('zxcvbn');
+const logger = require('./logger');
+
+// Configuration
+const PASSWORD_CONFIG = {
+  minLength: 12,
+  requireUppercase: true,
+  requireLowercase: true,
+  requireNumbers: true,
+  requireSpecialChars: true,
+  preventCommonPasswords: true,
+  minStrengthScore: 3, // zxcvbn score (0-4, where 3 is "good")
+  bcryptRounds: parseInt(process.env.BCRYPT_ROUNDS) || 12 // Configurable, default 12
+};
+
+// Common passwords to block (extend this list)
+const COMMON_PASSWORDS = [
+  'password', 'password123', 'admin123', 'welcome123', 'test123',
+  'qwerty', 'abc123', '123456', 'password1', 'admin',
+  'letmein', 'welcome', 'monkey', 'dragon', 'baseball'
+];
+
+/**
+ * Validate password meets security requirements
+ * @param {string} password - Password to validate
+ * @param {Object} options - Optional configuration overrides
+ * @returns {Object} - { valid: boolean, errors: string[], score: number, feedback: Object }
+ */
+function validatePassword(password, options = {}) {
+  const config = { ...PASSWORD_CONFIG, ...options };
+  const errors = [];
+  
+  // Check if password exists
+  if (!password || typeof password !== 'string') {
+    return {
+      valid: false,
+      errors: ['Password is required'],
+      score: 0,
+      feedback: {}
+    };
+  }
+  
+  // Check minimum length
+  if (password.length < config.minLength) {
+    errors.push(`Password must be at least ${config.minLength} characters long`);
+  }
+  
+  // Check uppercase requirement
+  if (config.requireUppercase && !/[A-Z]/.test(password)) {
+    errors.push('Password must contain at least one uppercase letter');
+  }
+  
+  // Check lowercase requirement
+  if (config.requireLowercase && !/[a-z]/.test(password)) {
+    errors.push('Password must contain at least one lowercase letter');
+  }
+  
+  // Check number requirement
+  if (config.requireNumbers && !/[0-9]/.test(password)) {
+    errors.push('Password must contain at least one number');
+  }
+  
+  // Check special character requirement
+  if (config.requireSpecialChars && !/[!@#$%^&*()_+\-=\[\]{};':"\\|,.<>\/?]/.test(password)) {
+    errors.push('Password must contain at least one special character');
+  }
+  
+  // Check against common passwords
+  if (config.preventCommonPasswords) {
+    const lowerPassword = password.toLowerCase();
+    if (COMMON_PASSWORDS.includes(lowerPassword)) {
+      errors.push('This password is too common. Please choose a more unique password');
+    }
+  }
+  
+  // Use zxcvbn for strength analysis
+  const strength = zxcvbn(password);
+  
+  // Check minimum strength score
+  if (strength.score < config.minStrengthScore) {
+    errors.push('Password is too weak. Please choose a stronger password');
+  }
+  
+  // Add zxcvbn suggestions
+  if (strength.feedback.suggestions.length > 0) {
+    errors.push(...strength.feedback.suggestions);
+  }
+  
+  return {
+    valid: errors.length === 0,
+    errors,
+    score: strength.score,
+    feedback: {
+      warning: strength.feedback.warning,
+      suggestions: strength.feedback.suggestions,
+      crackTime: strength.crack_times_display.offline_slow_hashing_1e4_per_second
+    }
+  };
+}
+
+/**
+ * Validate password for specific contexts (admin, gallery)
+ * @param {string} password - Password to validate
+ * @param {string} context - Context ('admin' or 'gallery')
+ * @param {Object} userData - Additional user data for context-aware validation
+ * @returns {Object} - Validation result
+ */
+function validatePasswordInContext(password, context, userData = {}) {
+  // Base validation
+  const result = validatePassword(password);
+  
+  // Context-specific validation
+  if (context === 'admin') {
+    // Admins need stronger passwords
+    if (result.score < 4) {
+      result.valid = false;
+      result.errors.push('Admin passwords must be very strong (score 4/4)');
+    }
+    
+    // Check password doesn't contain username
+    if (userData.username && password.toLowerCase().includes(userData.username.toLowerCase())) {
+      result.valid = false;
+      result.errors.push('Password must not contain your username');
+    }
+    
+    // Check password doesn't contain email
+    if (userData.email) {
+      const emailUser = userData.email.split('@')[0];
+      if (password.toLowerCase().includes(emailUser.toLowerCase())) {
+        result.valid = false;
+        result.errors.push('Password must not contain parts of your email');
+      }
+    }
+  } else if (context === 'gallery') {
+    // Gallery passwords can be slightly less strict
+    // but still need to be secure
+    if (result.score < 2) {
+      result.valid = false;
+      result.errors.push('Gallery passwords must have moderate strength or better');
+    }
+    
+    // Check password doesn't contain event name
+    if (userData.eventName && password.toLowerCase().includes(userData.eventName.toLowerCase())) {
+      result.valid = false;
+      result.errors.push('Password must not contain the event name');
+    }
+  }
+  
+  return result;
+}
+
+/**
+ * Generate a secure random password
+ * @param {Object} options - Generation options
+ * @returns {string} - Generated password
+ */
+function generateSecurePassword(options = {}) {
+  const config = {
+    length: options.length || 16,
+    includeUppercase: options.includeUppercase !== false,
+    includeLowercase: options.includeLowercase !== false,
+    includeNumbers: options.includeNumbers !== false,
+    includeSpecialChars: options.includeSpecialChars !== false,
+    excludeAmbiguous: options.excludeAmbiguous !== false
+  };
+  
+  let charset = '';
+  
+  if (config.includeLowercase) {
+    charset += config.excludeAmbiguous ? 'abcdefghjkmnpqrstuvwxyz' : 'abcdefghijklmnopqrstuvwxyz';
+  }
+  
+  if (config.includeUppercase) {
+    charset += config.excludeAmbiguous ? 'ABCDEFGHJKLMNPQRSTUVWXYZ' : 'ABCDEFGHIJKLMNOPQRSTUVWXYZ';
+  }
+  
+  if (config.includeNumbers) {
+    charset += config.excludeAmbiguous ? '23456789' : '0123456789';
+  }
+  
+  if (config.includeSpecialChars) {
+    charset += '!@#$%^&*()_+-=[]{}|;:,.<>?';
+  }
+  
+  if (charset.length === 0) {
+    throw new Error('At least one character type must be included');
+  }
+  
+  // Generate password
+  const crypto = require('crypto');
+  let password = '';
+  
+  for (let i = 0; i < config.length; i++) {
+    const randomIndex = crypto.randomInt(charset.length);
+    password += charset[randomIndex];
+  }
+  
+  // Ensure password meets requirements
+  const validation = validatePassword(password);
+  if (!validation.valid) {
+    // Recursively generate until we get a valid password
+    return generateSecurePassword(options);
+  }
+  
+  return password;
+}
+
+/**
+ * Get bcrypt rounds configuration
+ * @returns {number} - Number of bcrypt rounds to use
+ */
+function getBcryptRounds() {
+  return PASSWORD_CONFIG.bcryptRounds;
+}
+
+/**
+ * Log password validation failures for security monitoring
+ * @param {string} context - Context of validation failure
+ * @param {Array} errors - Validation errors
+ * @param {Object} metadata - Additional metadata
+ */
+function logPasswordValidationFailure(context, errors, metadata = {}) {
+  logger.warn('Password validation failed', {
+    context,
+    errorCount: errors.length,
+    errors: errors.slice(0, 3), // Log first 3 errors only
+    ...metadata
+  });
+}
+
+module.exports = {
+  validatePassword,
+  validatePasswordInContext,
+  generateSecurePassword,
+  getBcryptRounds,
+  logPasswordValidationFailure,
+  PASSWORD_CONFIG
+};

backend/src/utils/rateLimitSecurity.js

@@ -0,0 +1,119 @@
+/**
+ * Rate Limiting Security Utilities
+ * Provides secure rate limiting that prevents bypass attempts
+ */
+
+const jwt = require('jsonwebtoken');
+const logger = require('./logger');
+
+/**
+ * Safely check if a request has a valid admin token
+ * Used to determine if rate limiting should be skipped
+ * 
+ * IMPORTANT: This prevents the bypass vulnerability where
+ * invalid tokens could skip rate limiting
+ * 
+ * @param {Object} req - Express request object
+ * @returns {boolean} - True only if token is valid AND admin type
+ */
+function hasValidAdminToken(req) {
+  try {
+    // Only check admin paths
+    if (!req.path.startsWith('/api/admin/')) {
+      return false;
+    }
+
+    const authHeader = req.headers.authorization;
+    if (!authHeader || !authHeader.startsWith('Bearer ')) {
+      return false;
+    }
+
+    const token = authHeader.substring(7); // Remove 'Bearer ' prefix
+    
+    // Critical: Verify token is valid before skipping rate limit
+    // This prevents invalid tokens from bypassing rate limiting
+    const decoded = jwt.verify(token, process.env.JWT_SECRET);
+    
+    // Additional validation
+    if (!decoded || typeof decoded !== 'object') {
+      return false;
+    }
+    
+    // Must be admin type to skip rate limiting
+    if (decoded.type !== 'admin') {
+      logger.warn('Non-admin token attempted to bypass rate limit', {
+        path: req.path,
+        tokenType: decoded.type,
+        ip: req.ip
+      });
+      return false;
+    }
+    
+    // Optional: Check token age (prevent old tokens)
+    const tokenAge = Date.now() - (decoded.iat * 1000);
+    const maxAge = 24 * 60 * 60 * 1000; // 24 hours
+    
+    if (tokenAge > maxAge) {
+      logger.warn('Old admin token attempted to bypass rate limit', {
+        path: req.path,
+        tokenAge: Math.floor(tokenAge / 1000 / 60) + ' minutes',
+        ip: req.ip
+      });
+      return false;
+    }
+    
+    // Valid admin token - can skip rate limiting
+    return true;
+    
+  } catch (error) {
+    // Any error means token is invalid
+    // Log attempts with invalid tokens (potential attacks)
+    if (error.name === 'JsonWebTokenError') {
+      logger.warn('Invalid token attempted to bypass rate limit', {
+        path: req.path,
+        error: error.message,
+        ip: req.ip
+      });
+    }
+    
+    // Apply rate limiting for any invalid token
+    return false;
+  }
+}
+
+/**
+ * Create a skip function for rate limiter that prevents bypass
+ * @returns {Function} Skip function for express-rate-limit
+ */
+function createSecureSkipFunction() {
+  return (req) => {
+    // In development, be more lenient with public settings
+    if (process.env.NODE_ENV === 'development' && req.path === '/api/public/settings') {
+      return true;
+    }
+    
+    // Only skip for valid admin tokens
+    return hasValidAdminToken(req);
+  };
+}
+
+/**
+ * Log rate limit hits for security monitoring
+ * @param {Object} req - Express request object
+ * @param {Object} res - Express response object
+ */
+function logRateLimitHit(req, res) {
+  logger.warn('Rate limit exceeded', {
+    ip: req.ip,
+    path: req.path,
+    userAgent: req.headers['user-agent'],
+    remaining: res.getHeader('X-RateLimit-Remaining'),
+    limit: res.getHeader('X-RateLimit-Limit')
+  });
+}
+
+module.exports = {
+  hasValidAdminToken,
+  createSecureSkipFunction,
+  logRateLimitHit
+};

backend/src/utils/tokenRevocation.js

@@ -0,0 +1,133 @@
+/**
+ * Token Revocation System
+ * Provides ability to invalidate tokens before expiration
+ */
+
+const { db } = require('../database/db');
+const logger = require('./logger');
+
+/**
+ * Add a token to the revocation list
+ * @param {string} token - JWT token to revoke
+ * @param {string} reason - Reason for revocation
+ * @param {Object} metadata - Additional metadata
+ */
+async function revokeToken(token, reason, metadata = {}) {
+  try {
+    // Extract token info without full verification (it might be compromised)
+    const parts = token.split('.');
+    if (parts.length !== 3) {
+      throw new Error('Invalid token format');
+    }
+    
+    // Decode payload
+    const payload = JSON.parse(Buffer.from(parts[1], 'base64').toString());
+    
+    await db('revoked_tokens').insert({
+      token_id: payload.jti || `${payload.id}-${payload.iat}`, // JWT ID or fallback
+      user_id: payload.id,
+      token_type: payload.type,
+      revoked_at: new Date().toISOString(),
+      expires_at: new Date(payload.exp * 1000).toISOString(),
+      reason,
+      metadata: JSON.stringify(metadata)
+    });
+    
+    logger.info('Token revoked', {
+      userId: payload.id,
+      tokenType: payload.type,
+      reason
+    });
+    
+    return true;
+  } catch (error) {
+    logger.error('Failed to revoke token', error);
+    return false;
+  }
+}
+
+/**
+ * Check if a token is revoked
+ * @param {Object} decodedToken - Decoded JWT payload
+ * @returns {boolean} - True if token is revoked
+ */
+async function isTokenRevoked(decodedToken) {
+  try {
+    const tokenId = decodedToken.jti || `${decodedToken.id}-${decodedToken.iat}`;
+    
+    const revoked = await db('revoked_tokens')
+      .where('token_id', tokenId)
+      .orWhere((builder) => {
+        builder
+          .where('user_id', decodedToken.id)
+          .where('revoked_at', '<=', new Date(decodedToken.iat * 1000).toISOString());
+      })
+      .first();
+    
+    return !!revoked;
+  } catch (error) {
+    logger.error('Failed to check token revocation', error);
+    // Fail closed - treat as revoked if we can't check
+    return true;
+  }
+}
+
+/**
+ * Revoke all tokens for a user
+ * @param {number} userId - User ID
+ * @param {string} reason - Reason for revocation
+ */
+async function revokeAllUserTokens(userId, reason) {
+  try {
+    // This effectively revokes all tokens by setting a revocation time
+    // Any token issued before this time will be considered revoked
+    await db('user_token_revocations').insert({
+      user_id: userId,
+      revoked_at: new Date().toISOString(),
+      reason
+    }).onConflict('user_id').merge();
+    
+    logger.info('All user tokens revoked', { userId, reason });
+    return true;
+  } catch (error) {
+    logger.error('Failed to revoke user tokens', error);
+    return false;
+  }
+}
+
+/**
+ * Clean up expired revoked tokens
+ * Should be run periodically
+ */
+async function cleanupExpiredRevocations() {
+  try {
+    const deleted = await db('revoked_tokens')
+      .where('expires_at', '<', new Date().toISOString())
+      .delete();
+    
+    if (deleted > 0) {
+      logger.info(`Cleaned up ${deleted} expired token revocations`);
+    }
+  } catch (error) {
+    logger.error('Failed to cleanup revoked tokens', error);
+  }
+}
+
+/**
+ * Initialize cleanup job for expired revocations
+ */
+function initializeRevocationCleanup() {
+  // Run cleanup every 6 hours
+  setInterval(cleanupExpiredRevocations, 6 * 60 * 60 * 1000);
+  
+  // Run initial cleanup
+  cleanupExpiredRevocations();
+}
+
+module.exports = {
+  revokeToken,
+  isTokenRevoked,
+  revokeAllUserTokens,
+  cleanupExpiredRevocations,
+  initializeRevocationCleanup
+};